Fix zipslip for jar

src/org/jetbrains/java/decompiler/main/decompiler/DirectoryResultSaver.java

@@ -5,6 +5,7 @@
 import org.jetbrains.java.decompiler.util.InterpreterUtil;
 
 import java.io.*;
+import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.jar.Manifest;
@@ -82,11 +83,19 @@ public void saveClassFile(String path, String qualifiedName, String entryName, S
 
   @Override
   public void copyEntry(String source, String path, String archiveName, String entryName) {
+    String rootPath = this.root.toString();
+
     try (ZipFile srcArchive = new ZipFile(new File(source))) {
       ZipEntry entry = srcArchive.getEntry(entryName);
       if (entry != null) {
         try (InputStream in = srcArchive.getInputStream(entry)) {
-          InterpreterUtil.copyStream(in, new FileOutputStream(this.root.resolve(entryName).toFile()));
+          String cleanedPath =  FileSystems.getDefault().getPath("/"+entryName).normalize().toString();
+          File joinedPath = java.nio.file.Paths.get(rootPath, cleanedPath).toFile();
+          if (!joinedPath.toString().startsWith(rootPath)) { 
+            throw new IOException("unable to verify safe file path"); 
+          }
+
+          InterpreterUtil.copyStream(in, new FileOutputStream(joinedPath));
         }
       }
     }

test/org/jetbrains/java/decompiler/CommandLineTest.java

@@ -6,9 +6,14 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import java.io.File;
+import java.io.FileOutputStream;
 import java.io.IOException;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
 
 import static org.jetbrains.java.decompiler.DecompilerTestFixture.assertFilesEqual;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 
 public class CommandLineTest {
   private DecompilerTestFixture fixture;
@@ -48,6 +53,30 @@ public void testJarToDir() {
     assertFilesEqual(fixture.getTestDataDir().resolve("bulk"), fixture.getTempDir().resolve("bulk_out"));
   }
 
+  @Test
+  public void testMaliciousJarToDir() throws IOException {
+    String out = fixture.getTempDir().resolve("bulk_out").toAbsolutePath().toString();
+    String in = fixture.getTestDataDir().resolve("mal.jar").toAbsolutePath().toString();
+    // create malicious jar if doesn't exist already
+    if (!new File(in).exists())
+    {
+      String badFileName = new String("../../../../../../../../../../../tmp/test.txt");
+      try (ZipOutputStream maliciousOut = new ZipOutputStream(new FileOutputStream(fixture.getTestDataDir().resolve("mal.jar").toAbsolutePath().toString())))
+      {
+          ZipEntry entry = new ZipEntry(badFileName);
+          maliciousOut.putNextEntry(entry);
+          maliciousOut.write("womp womp".getBytes());
+          maliciousOut.closeEntry();
+      }
+    }
+
+    ConsoleDecompiler.main(new String[]{in, out});
+
+    TextBuffer.checkLeaks();
+    File f = new File("/tmp/test.txt");
+    assertFalse(f.exists());  
+}
+
   @Test
   public void testZipToJar() {
     String out = fixture.getTempDir().resolve("bulk_out.jar").toAbsolutePath().toString();